Internal search needs permission checks

A search assistant can answer a question accurately and still create a security problem. If a manager asks about a customer contract, a correct answer drawn from a restricted acquisition folder is still the wrong answer to give that manager.

When you add AI search to internal documents, access control belongs in the retrieval path. A sentence in the prompt asking the model to respect permissions is not an enforcement mechanism.

Retrieval creates another route to the same information

The original 2020 retrieval-augmented generation paper combines a model with retrieved material to support knowledge-intensive tasks. That is useful context for the architecture, but it does not establish that a particular business search system enforces document permissions.

Treat every new route to the information as something to review: the source document, search index, retrieved excerpt, answer cache, and conversation history.

NIST's August 2020 Zero Trust Architecture frames access around resources and explicit authentication and authorization rather than assumed trust from network location. Applied to an internal assistant, the question is whether this user may access this resource for this request.

Resolve identity outside the model

The server should establish the signed-in user, workspace, and relevant group memberships. It should then apply the access policy before restricted text reaches the model.

Do not let a tool argument supplied by the model determine which tenant the user belongs to. A request containing another workspace identifier must not become authority to search that workspace.

There are several possible implementations. Some indexes can apply permission filters during retrieval. Others require a separate authorization check against each candidate resource before returning its text. The requirement is the same: unauthorized content must not enter the answer context.

Test the lifecycle, not just the first upload

A document's permissions can change after indexing. So can the user's role.

Use an illustrative review sequence like this:

1. Give a test user access to a project folder and verify a cited answer.
2. Remove that access at the source.
3. Ask the same question in a new conversation.
4. Ask a follow-up in the old conversation.
5. Repeat with an answer that was previously cached.

Set a defined propagation target for permission changes. During a delay, the system needs an explicit policy rather than an accidental stale copy.

Be precise about what revocation can do. It cannot make a person forget information already displayed. It can stop further retrieval and prevent retained server-side history from being reused in ways that violate the current policy.

A citation is also a possible disclosure

A restricted document's title, customer name, or folder path can reveal information even if the answer omits the body. Check citations and previews under the same policy as the source.

For a denied request, avoid confirming that a sensitive document exists. Provide the ordinary answer the user can receive from authorized material, or explain that the assistant cannot provide the requested information.

Cache keys deserve the same attention. A cache indexed only by question text can return one person's answer to another. Partition answers by the relevant authorization context, or revalidate the sources before reuse.

Build an access matrix with the operation owner

A small test matrix is more useful than a general promise that the assistant is secure.

User	Material	Expected result
Account team member	Their assigned customer's approved documents	Answer with accessible citations
Account team member	Another customer's restricted folder	No content, title, or preview leakage
Former project member	A previously accessible folder	No new retrieval after the revocation policy takes effect
Workspace administrator	Another organization's index	No cross-workspace access

Ask the owner to confirm the intended boundaries, then test them with real user roles.

An internal assistant should make approved knowledge easier to find. It should not quietly broaden the group of people allowed to read it.